Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 06:20
Behavioral task
behavioral1
Sample
5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe
-
Size
19KB
-
MD5
5f5af75e90daed44179d7c7c0ba78ca2
-
SHA1
0dfc0449ec2fceabddf6b61fb1c7fe8028adc73d
-
SHA256
34ecd00527928571ec1fa719ed41d3b6ac45a8f4d7450d888002b5a02a73725d
-
SHA512
3d180d73b54420690aea1e90729f38640e3690e8afb6cf609ba30c91c2be0e8f8cc0d34efaccd1411ccd9b83f6d6baa97bab53c1a009567f3005166e2b4b06a9
-
SSDEEP
384:NQvVZ+qNevutLv8Wmwsjp0B/cFI2TeOhGaNJawcudoD7Uy:YZ+qNevAUwLGIjQnnbcuyD7U
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe" 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000023442-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 4372 sbsm.exe -
Loads dropped DLL 1 IoCs
pid Process 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/2004-0-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/files/0x0009000000023442-2.dat upx behavioral2/memory/2004-10-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\ 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\Main 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\Search 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.pcsearching.com/index.php?b=1&t=0&q={searchTerms}" 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Software\Microsoft\Internet Explorer\SearchScopes 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.explorertool.net/redirect.php" 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\xxx = "xxx" 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\InprocServer32 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\InprocServer32\ThreadingModel = "Apartment" 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 4372 sbsm.exe 4372 sbsm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2004 wrote to memory of 4372 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 84 PID 2004 wrote to memory of 4372 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 84 PID 2004 wrote to memory of 4372 2004 5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5f5af75e90daed44179d7c7c0ba78ca2_JaffaCakes118.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5cabe6a7f6710bf5a1a58f5ef6d5d1655
SHA11f8f0ea75891450761ddcdfedf318e39a52dd782
SHA256da47e5a99afda9469d88cf2a9419fba15d6c5c5d442481a2c436690367c1e4c7
SHA51239db7562f74093e30c1dceb86985f04f6d9210a7c494906dcb6af76dbbf10438feeb773024927192d7eb235f3846b6abeb642ab2c3233f346782277a54aea7a9
-
Filesize
7KB
MD5649f1a366a550064b4aadb4a039b2885
SHA13ea13e9ca5e089e92daf104bc3b661a547fab2e6
SHA2564eed9c3e0c7beff6d791773b5231fdfaa04a48dabdb0d06421133326febaf35e
SHA512e1bb06bc44ddf733b55b585573ce4ede2c75e28b5bc54d74d120199d04c372110b8e22c8cb36ad4e109ed8573f3ad2e0bd7080e0fd344bcd579b208eb967e6d3